Updating rescue software

• US 20070094654A1
• Filed: 10/20/2005
• Published: 04/26/2007
• Est. Priority Date: 10/20/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Costea, Mihai
• Application Number:
  US11/254,833
• Publication Number:
  US 20070094654A1
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

The present invention causes rescue software to be updated when a secondary operating system is “booted” from a rescue disk. Aspects of the present invention may cause a computer to be “booted” using the rescue software when a user turns on a computer. Once the computer is booted using the rescue software, a source where a software update to the rescue software may be obtained is identified. Then, a determination is made regarding whether the software update originates from a trusted entity. In instances when the software update originates from a trusted entity, the rescue software is updated with one or more software updates.

Claims

1. A method of updating rescue software that includes an operating system for managing execution of programs, the method comprising:

(a) identifying a source where a software update to the rescue software may be obtained;

(b) determining whether the software update originates from a trusted entity; and

(c) if the software update originates from a trusted entity, applying the software update to the rescue software.

2. The method as recited in claim 1, further comprising if the software update does not originate from a trusted entity, preventing the software update from being applied to the rescue software.

3. The method as recited in claim 1, further comprising causing an installer program to install the software update on the computer.

4. The method as recited in claim 1, wherein identifying a source where a software update may be obtained includes determining whether the necessary conditions exist to obtain the software update from the trusted entity.

5. The method is as recited in claim 4, wherein the source is a location on a communication network and determining whether the necessary conditions exist to obtain the software update includes determining whether the computer is connected to the communication network.

6. The method as recited in claim 1, wherein identifying a source where a software update to the rescue software may be obtained includes determining whether a storage medium on the computer contains more recently developed malware signatures than the rescue software.

7. The method as recited in claim 6, wherein determining whether a storage medium on the computer contains more recently developed malware signatures includes comparing version numbers associated with a software component that contains the malware signatures.

8. The method as recited in claim 1, wherein the software update contains cleaning routines for removing malware from the computer.

9. The method as recited in claim 1, wherein determining whether the software update originates from a trusted entity includes:

(a) assigning a digital signature to one more components of the rescue software; and

(b) determining whether a digital signature received from a trusted entity is valid.

10. The method as recited in claim 1, wherein applying the software update includes downloading the software update from a location on a communication network.

11. A software system for updating rescue software that identifies malware on a computer, the rescue software comprising:

(a) an operating system for managing resources of the computer and executing application programs;

(b) a scan engine operative to search for data that is characteristic of malware;

(c) a signature database for storing signatures that uniquely identify malware; and

(d) an update routine operative to obtain malware signatures from a trusted entity and cause the signatures to be stored in the signature database.

12. The software system as recited in claim 11, further comprising a malware cleaner that includes cleaning routines for removing malware from the computer;

and

wherein the update routine is further configured to obtain malware cleaning routines from the trusted entity.

13. The software system as recited in claim 11, further comprising utilities that are operative to establish a network connection with a remote computer on a communication network.

14. The software system as recited in claim 11, wherein the update routine is further configured to determine whether the malware signatures originate from the trusted entity by obtaining a digital signature from the trusted entity and determining whether the signature is valid.

15. The software system is recited in claim 11, wherein the update routine is further configured to determine whether a version of the malware signatures that is available from the trusted entity is more recent than the version of the malware signatures that is provided in the rescue software.

16. A computer-readable medium containing computer-readable instructions which, when executed in a computer, performs a method of updating rescue software that includes an operating system for managing execution of programs, the method comprising:

(a) identifying a source where a software update to the rescue software may be obtained;

(b) determining whether the software update originates from a trusted entity, including;

(i) assigning a digital signature to a component of the rescue software; and

(ii) determining whether a digital signature assigned to a component of the rescue software that is available from a trusted entity is valid;

(c) if the software update originates from the trusted entity, applying the software update to the rescue software; and

(d) conversely, if the software update does not originate from the trusted entity, preventing the software update from being applied to the rescue software.

17. The computer-readable medium as recited in claim 16, wherein the software update obtained is available from the trusted entity includes one or more malware signatures.

18. The computer-readable medium as recited in claim 16, wherein the software update that is available from the trusted entity includes one or more cleaning routines for removing malware from the computer.

19. The computer-readable medium as recited in claim 16, wherein the source is a location on a communication network and determining whether the necessary conditions exist to obtain the software update includes determining whether the computer is connected to the communication network.

20. The computer-readable medium as recited in claim 16, wherein applying the software update includes:

(a) downloading the software update from a location on a communication network; and

(b) causing an installer program to update data in memory on the computer.